Discuss January 2009

discuss@lists.centos.org

272 participants
261 discussions

Re: [CentOS] Antivirus for CentOS? (yuck!)
by David G. Miller 23 Jan '09

23 Jan '09

Stephen John Smoogen <smooge(a)gmail.com> wrote: > On Thu, Jan 22, 2009 at 12:42 PM, David G. Miller <dave(a)davenjudy.org> wrote: > >> > Amos Shapira <amos.shapira(a)gmail.com> wrote: >> > >> >>> >> Hi All, >>> >> >>> >> Yes, I know, it's really really embarrassing to have to ask but I'm >>> >> being pushed to the wall with PCI DSS Compliance procedure >>> >> (http://en.wikipedia.org/wiki/PCI_DSS) and have to either justify why >>> >> we don't need to install an anti-virus or find an anti-virus to run on >>> >> our CentOS 5 servers. >>> >> >>> >> Whatever I do - it needs to be convincing enough to make the PCI >>> >> compliance guy tick the box. >>> <SNIP> >> > After reading all of the other replies (including the ones that pointed >> > out that the PCI DSS requirement had changed the terminology from >> > "virus" to "malware"), why not claim you are meeting the requirement by >> > doing something useful like running chkrootkit or rkhunter on a regular >> > basis? That way you would be scanning the systems for the only malware >> > known to actually pose a threat to a Linux box. It may be a low >> > probability of infection (as others have pointed out) but should satisfy >> > the auditor and hopefully will just be a low cost exercise in futility >> > as long as reasonable security policies are followed. >> > > Any tool will require the need to have a risk assessment against it. > What is the liklihood of it finding malware? How much is updated and > how does it compare to other tools. These will be questions that will > need to be available for auditors to know you did your due-diligence > on selecting a tool. Answering those questions would provide the arguments for running a root kit scanner instead of anti-virus software. That is, the risk of malware affecting the systems in question is low with near zero likelihood that a true virus will cause a problem but with the possibility that a rootkit could compromise the systems. Chkrootkit and rkhunter are arguably the best tools for finding a root kit. The programs are updated whenever a new threat is identified. Obviously, the OP would need more than my say so as back up for these assertions. Said back up would also make the case that scanning for non-existent threats (Linux viruses) would make no sense while scanning for a real threat makes the most sense. Cheers, Dave -- Politics, n. Strife of interests masquerading as a contest of principles. -- Ambrose Bierce

2 1

OT: Managing change control in servers, LDAP, firewalls and switches question
by Erick Perez 23 Jan '09

23 Jan '09

Hi, being an off-topic questions with so many vendors involved I had no definitive place to go to ask but here. So maybe some of the list members have ideas in mind. Currently we manage several switches,firewalls and MS LDAP and Centos OpenLDAP installations. We are looking for a "man in the middle" or "framework" to manage change on our network devices and LDAP-based servers. So far, using Quest ActiveRoles/Intrust has filled the part of LDAP, where administrators log into ActiveRoles/Intrust system, generate changes (delete OU, users, change passwords, etc) then the request has to be approved by a staff member in Activeroles/intrust. When the approval is sent to the system, the ActiveRoles/Intrust (and not the sysadmin) logs into the LDAP systems and perform the changes. This has proven useful in tracking changes (who did what, when, who approved it). We are looking into a similar solution (Quest Software does not have that for devices) to perform change and control on the routers, switches and firewalls. Maybe someone can also point me to a mailing list where i can ask the same question? thanks, -- ------------------------------------------------------------ Erick Perez Cel +(507) 6675-5083 ------------------------------------------------------------

4 4

SquirrelMail Sending Under Wrong Username
by John Hinton 23 Jan '09

23 Jan '09

CentOS team... as is already bug reported and marked solved... as we await the upstream repair for this. It was reported that this was happening on CentOS 5. You likely already know, but it also happens on CentOS 4. For those unaware. It seems that SquirrelMail has an issue which allows mail to be sent out from one user on the system and it uses the from address of another user on the system. Apparently, both users need to be logged into SM at the same time. My client reported that when he sent the affected message, he received a connection lost notice. He logged in again, stated that the email was in fact sent. The recipient of that email asked what was up with the odd from address. Looking at the headers from that message, they do in fact show adifferentusername(a)thisparticularservername.com. This is about the most embarrassing thing that's ever happened with my servers. Obviously the affected user is not feeling very secure. It does invite the recipient to reply to the wrong address which could be bad on so many levels (imagine having a few local law firms hosted on the same server?). I view this as a horrid security issue. If maybe the CentOS team might be so kind as to push the SquirrelMail update to the front when it's ready, that would be greatly appreciated. John Hinton

3 2

Seeking translators
by Ralph Angenendt 23 Jan '09

23 Jan '09

Hi, anyone here who wants to really help out with the CentOS project? Then please check if you speak a language which is not yet on <http://wiki.centos.org/Manuals/ReleaseNotes/CentOS5.2> and help us translate the Release Notes for 5.3 (and 5.4, 5.6, 6.0 and whatever comes next). If you want to help out, please contact me *off* list. I have a slight timing issue (some parts have to be done by next Thursday, but that really is only a small part) and I'm sorry for not contacting this list earlier :) So if you can and want to help - send me a mail! Cheers, Ralph

1 0

OT: Looking for a timer/counter script
by Thomas Dukes 23 Jan '09

23 Jan '09

Hello, Was hoping someone could help me find a script for a website that increments at a specified rate over a specified period of time, something similar to the US National Debt site. I searched hotscripts but not really sure what this type script would be called. TIA PS I looked at the code for the national debt script but I can't make head or tails of it.

3 2

libpython2.4.so.1.0 i386
by Ed Donahue 23 Jan '09

23 Jan '09

I am running Kernel 2.6.18-92.1.18.el5 x86_64. I need /usr/lib/libpython2.4.so.1.0 for virtualbox. I have python-2.4.3-21.el5.i386.rpm installed which is supposed to provide it. Can I just grab the rpm and take out libpython2.4.so.1.0 and just put it in /usr/lib ? Not sure how to do that. I figured a sym-link would have the app not compile correctly (if at all) with the 64-bit lib. Tried yum with no luck: yum localinstall -y --nogpgcheck VirtualBox-2.1.2_41885_rhel5-1.i386.rpm --> Running transaction check ---> Package VirtualBox.i386 0:2.1.2_41885_rhel5-1 set to be updated --> Processing Dependency: libpython2.4.so.1.0 for package: VirtualBox --> Finished Dependency Resolution Error: Missing Dependency: libpython2.4.so.1.0 is needed by package VirtualBox rpm -qa|grep python|sort ... python-2.4.3-21.el5 python-crypto-2.0-1.2.el5.rf python-elementtree-1.2.6-5 python-game-1.8.1-1.el5.rf python-iniparse-0.2.3-4.el5 python-khashmir-4.4.0-1.el5.rf python-ldap-2.2.0-2.1 python-numeric-23.7-2.2.2 python-sqlite-1.1.7-1.2.1 python-urlgrabber-3.1.0-2 python-xdg-0.17-1.el5.rf rpm-python-4.4.2-48.el5

1 0

Question on upgrading hardware
by Bob Hoffman 23 Jan '09

23 Jan '09

For centos 5.x Two questions regarding upgrading hardware or system. 1- If I were to shut off the server and add more ram, switch out ram, remove one of the two cpus, or replace the two cpus with bigger or smaller ones.....Would I just be able to restart the server or would I have to do something with the configuration somewhere? 2- If I built another system, slightly different motherboard but most of the rest the same as far as hardware, would taking a drive from the old system and adding it to the new system work correctly and recognize what it needs? Thanks for any advice on the upgrading.

3 2

where did all the nonfree rpms go? Nvidia? xine-lib-mp3?
by Paul Johnson 23 Jan '09

23 Jan '09

I installed Centos on some machines that need long term support. I'm running up against some simple user convenience issues. How to play MP3? I've been really puzzled today that the addon rpm sites like livna, rpmforge, rpmfusion, epel, don't seem to have something like amarok-mp3 or xine-lib-mp3. What am I missing? It can be done in Ubuntu, Debian, and Fedora Linux. In the worst case scenario, what must be done? get the xine source code and build an rpm that includes the mp3 components? Do you have Nvidia cards? Then I noticed there is a new Nvidia proprietary driver on www.nvidia.org, and I can't find an rpm package for it, or for the previous 2 releases of the nvidia driver. The place to get those packages used to be rpm.livna.org, but that is now moved to rpmfusion, but on the rpmfusion site, the nonfree folders are empty. Oh, well. Just singing a complaining song. pj -- Paul E. Johnson

4 3

start network installation with HP 8530w with Intel ethernet card
by MOKRANI Rachid 23 Jan '09

23 Jan '09

Hi, I have an HP 8530w laptop. I need ti instal it under CentOS 5.2 x86_64 - kernel 2.6.18-92. The network card is not recognized. I have add the driver e1000e-0.5.11.2 (dowload from Intel site). After compiled and installed the driver, all work fine! But I need to make a network installation and the Intel network card should be recognized before. I found the following script on the net and try it. ------------------------------------------------------------------------ ------------------------------ wget http://my_web_server/CentOS/5.2/x86_64/images/diskboot.img cp diskboot.img diskboot.orig.img mkdir diskboot_mnt mount -o loop diskboot.img diskboot_mnt mkdir initrd_extracted cd initrd_extracted gunzip < ../diskboot_mnt/initrd.img | cpio -i --make-directories cd .. mkdir modules_extracted cd modules_extracted gunzip < ../initrd_extracted/modules/modules.cgz | cpio -i --make-directories cd 2.6.18-92.el5/x86_64 rm e1000e.ko wget http://my_web_server/e1000e.ko # Now put humpty back together again cd ../../ find . -print |cpio -o -Hnewc | gzip -c9 > ../modules.cgz cd .. cp -fp --no-preserve=all modules.cgz initrd_extracted/modules/ cd initrd_extracted find . -print |cpio -o -Hnewc | gzip -c9 > ../initrd.img cd .. cp -fp initrd.img diskboot_mnt/ # cleanup umount diskboot_mnt rm -rf diskboot_mnt/ initrd_extracted/ initrd.img modules.cgz modules_extracted/ mv diskboot.img diskboot.mod.img dd if=diskboot.mod.img of=/dev/sdb ------------------------------------------------------------------------ ----------------------------------------- After trying to start on a USB key, the network card is not recognized again :-( Something is missing ... how to add this network driver for starting a network installation ? Anybody do this before ? Best Regards (and sorry for my poor english) __________________________ Ce message (et toutes ses pièces jointes éventuelles) est confidentiel et établi à l'intention exclusive de ses destinataires. Toute utilisation de ce message non conforme à sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'IFP décline toute responsabilité au titre de ce message. This message and any attachments (the message) are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. IFP should not be liable for this message. Visitez notre site Web / Visit our web site : http://www.ifp.fr __________________________

1 0

Re: [CentOS] where did all the nonfree rpms go? Nvidia? xine-lib-mp3?
by Ralph Angenendt 23 Jan '09

23 Jan '09

Sorin Srbu wrote: > Why don't you get your proprietary drivers from nvidia.com? Or do you need an > actual rpm-package? Anyway, you're bound to get newest stuff from Nvidia.com. Yes, using an rpm package is better, as the packaged drivers do not remove libGL.so, for example, like the nvidia driver does. Cheers, Ralph

2 1

← Newer
1
...
7
8
9
10
11
12
13
...
27
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss January 2009